Security advice aimed at small businesses tends to describe threats that small businesses do not face. Advanced persistent threats, zero-day exploits, sophisticated adversaries. It is exciting and it is not what is emptying bank accounts in Lahore and Karachi.
What actually happens is mundane. Someone emails your accounts clerk pretending to be a supplier with new bank details. Someone sends your sales manager a fake login page. Someone convinces a mobile operator's shop to reissue a director's SIM. Someone opens a cracked copy of accounting software that came bundled with a remote access tool.
Every one of those is defeated by controls that are cheap, boring and almost never implemented. Here they are.
The short version
- The realistic threats to a Pakistani SME are invoice and payment fraud, credential phishing, SIM swap, pirated software, and account takeover. In roughly that order.
- Business email compromise is the expensive one. It is not a hacking problem, it is a process problem, and one rule stops it.
- Pirated software is a security control failure, not a licensing one. The cost is not the fine, it is what came with the crack.
- Seven controls cover almost the entire realistic threat surface. Five of them are free.
- Have the incident plan written before you need it, including who you call. In Pakistan that includes the FIA's National Response Centre for Cyber Crime.
What actually hits businesses here
Invoice and payment fraud, or business email compromise. An attacker watches a real email thread, or simply guesses one, then sends a convincing message changing the bank details on an invoice. Your team pays the new account. There is no malware, no breach, nothing for antivirus to catch. This is the single largest source of direct financial loss for SMEs and it is entirely a process failure.
Credential phishing. A fake login page for your email, your bank, your Meta Business account or your ad account. The page is a perfect copy. Someone types their password. The damage varies from annoying to catastrophic depending on what that account controls.
SIM swap and WhatsApp takeover. Mobile numbers are the recovery method for nearly everything, which makes them the highest-value target. Attackers social-engineer a reissue, or phish a WhatsApp verification code by pretending to be a contact who "sent a code to the wrong number". We wrote the executive version of this in the founder's guide to secure SIMs.
Pirated and cracked software. This deserves its own paragraph because it is culturally normalised here and it is a genuine, ongoing compromise vector. A crack is, by construction, code from an untrusted party with permission to modify a program. Cracked software is one of the most common ways ransomware and credential stealers arrive on a business machine, and the machine it arrives on is usually the accountant's.
Insider data theft. Usually a departing employee taking the customer list. Rarely dramatic, frequently costly, almost always possible because everyone had access to everything.
Ad and social account takeover. For consumer businesses this can be the worst day of the year: your Meta Business account taken, your page used to run ads on your card, your customer relationships gone.
The seven controls
| # | Control | Cost | What it stops |
|---|---|---|---|
| 1 | Callback verification on any change of bank details | Free | Invoice and payment fraud |
| 2 | Phishing-resistant multi-factor authentication on email, banking and ad accounts | Free to low | Credential phishing, account takeover |
| 3 | A password manager, company-wide | Low | Password reuse, the single most common root cause |
| 4 | Licensed software and automatic updates | Moderate | Ransomware, credential stealers, remote access tools |
| 5 | Least privilege: people can only reach what their job needs | Free, needs discipline | Insider theft, blast radius of any single compromise |
| 6 | Tested backups, one copy offline or immutable | Low | Ransomware, hardware failure, the intern |
| 7 | A written incident plan naming who does what | Free | The forty-eight hours of confusion that makes everything worse |
1. Callback verification, the highest-return rule in business security
Any request to change bank details, by any channel, is verified by calling a known number on file. Never a number in the message. No exceptions for urgency, for seniority, or for a supplier you have worked with for ten years. Urgency is the tell.
Write it into the payment procedure, tell the finance team they will never be criticised for making the call, and have the owner say out loud that an email from them asking for an urgent transfer should always be verified. Most BEC losses happen because a junior employee did not feel able to question a senior-sounding instruction.
2. Multi-factor authentication, applied to the right accounts
Not everything at once. In priority order: company email, business banking, the Meta and Google business accounts, the domain registrar, and the cloud console. Email first, because email is the recovery path for everything else.
SMS codes are better than nothing and are the weakest form, because of SIM swap. Prefer an authenticator app, and for owners and finance staff, hardware security keys are inexpensive and effectively end phishing for those accounts.
3. A password manager, for the whole company
Password reuse is the root cause behind a large share of account takeovers. One breached forum from 2019 gives an attacker the password to your email. A password manager is the only intervention that actually works, because it removes the human need to remember.
4. Licensed software, updated automatically
This is the recommendation people resist on cost, so here is the arithmetic honestly: compare the annual licence cost against the cost of a week of downtime, a rebuilt accounts system, and a data loss you have to explain to clients. For an export services business with contractual security obligations to foreign clients, cracked software on a production machine is also a contract breach waiting to be discovered.
Set updates to install automatically. Unpatched software is the second most common entry point after a person.
5. Least privilege
Most Pakistani SMEs run with everyone able to reach everything, because it is convenient and because the team is small and trusted. Trust is not the issue. Blast radius is the issue. When one account is compromised, least privilege is the difference between an incident and a catastrophe.
Start with the customer database, the accounting system and the bank. Those three, restricted properly, cover most of the risk.
6. Backups you have actually restored
An untested backup is a belief, not a control. Once a quarter, restore something and confirm it works. Keep one copy that ransomware cannot reach, offline or immutable.
7. The incident plan
One page. Who is called first, who talks to clients, who contacts the bank, who preserves evidence, and the fact that nobody wipes anything before it is imaged. For financially motivated cybercrime in Pakistan, reporting goes to the FIA's cybercrime wing, and the first hour of evidence preservation determines whether that report can go anywhere.
Devices and remote teams
If part of your team works remotely, or you use offshore assistants, the device is the perimeter. We wrote the policy that actually gets followed in corporate device security for distributed VA teams, and the hardware question for executives in the executive phone stack.
The short version for a small business: company-controlled accounts, screen lock enforced, disk encryption on, a way to revoke access the day someone leaves, and a written rule about what may be stored locally.
Compliance, briefly
If you serve clients in the EU or UK, their data protection obligations flow to you through your contract, whether or not local law requires it. If you serve US healthcare or financial clients, the same applies with different acronyms. Read what you signed.
Pakistan's own personal data protection legislation has been in progress for several years and its status should be checked directly rather than assumed. The practical position for an exporter is that your clients' requirements will bind you before local law does, and those requirements are already in your contracts.
If you want a structure to organise all of this against rather than a list, the NIST Cybersecurity Framework is free, readable and proportionate for a small business. For anything you build yourself, start from OWASP.
Frequently asked questions
What is the most common cyber attack on small businesses in Pakistan?
Payment and invoice fraud, usually delivered by email and often with no malware involved at all. It is a process vulnerability rather than a technical one, and callback verification on bank detail changes stops nearly all of it.
Is pirated software really a security risk, or just a licensing issue?
It is genuinely a security risk. A crack modifies a program using code from an unknown party, and cracked installers are a well-documented delivery route for ransomware and credential stealers. The machines involved are usually the ones with the accounts and customer data on them.
What should I do if my business email is hacked?
Change the password and revoke active sessions immediately, check for forwarding rules the attacker created, which is the step most people miss, warn every client on the affected threads before they get a fraudulent invoice, notify your bank, preserve the evidence, and report to the FIA's cybercrime unit.
How much should a small business spend on cybersecurity?
Five of the seven controls above cost nothing but discipline. Start there. Paid spend, in order: licensed software, a password manager, backups, hardware security keys for the two or three accounts that matter most.
Do we need cyber insurance in Pakistan?
Consider it once you hold significant customer data or your revenue would stop during an outage. Read the exclusions carefully, particularly around social engineering losses, which is exactly the category most SMEs suffer. Insurance is not a substitute for the seven controls, and most policies expect them.
Where to go next
Security for an SME is an operations discipline, not a product you buy. If you want the controls implemented as part of how the business runs rather than as a document nobody reads, that is business operations consulting. If you are an exporter with client security obligations you are not sure you meet, send us the clause and we will tell you straight.
